/* vim: set expandtab ts=4 sw=4: */ /* * You may redistribute this program and/or modify it under the terms of * the GNU General Public License as published by the Free Software Foundation, * either version 3 of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #define _GNU_SOURCE // chroot(), MAP_ANONYMOUS #include "benc/Dict.h" #include "benc/String.h" #include "exception/Err.h" #include "util/log/Log.h" #include "util/Security.h" #include "memory/Allocator.h" #include "util/Setuid.h" #include "util/events/EventBase.h" #include "util/events/Timeout.h" #include #include #include #include #include #include #include #include #include Dict* Security_getUser(char* userName, struct Allocator* retAlloc) { struct passwd* pw; if (userName) { pw = getpwnam(userName); } else { pw = getpwuid(getuid()); } Dict* ret = Dict_new(retAlloc); if (!pw) { Dict_putString(ret, String_new("error", retAlloc), String_printf(retAlloc, "Could not find user [%s]", strerror(errno)), retAlloc); return ret; } Dict_putString(ret, String_new("error", retAlloc), String_new("none", retAlloc), retAlloc); Dict_putString(ret, String_new("name", retAlloc), String_new(pw->pw_name, retAlloc), retAlloc); Dict_putInt(ret, String_new("uid", retAlloc), pw->pw_uid, retAlloc); Dict_putInt(ret, String_new("gid", retAlloc), pw->pw_gid, retAlloc); return ret; } Err_DEFUN Security_setUser(int uid, int gid, bool keepNetAdmin, struct Log* logger, struct Allocator* alloc) { int gidErrno = 0; int uidErrno = 0; if (keepNetAdmin) { Err(Setuid_preSetuid(alloc)); } if (gid && setgid(gid)) { gidErrno = errno; } if (setuid(uid)) { // errno is global and could get overwritten by Setuid_postSetuid() uidErrno = errno; } if (keepNetAdmin) { Err(Setuid_postSetuid(alloc)); } if (uidErrno > 0) { Err_raise(alloc, "Failed to set UID [%s]", strerror(uidErrno)); } if (uid != (int) getuid()) { Err_raise(alloc, "Failed to set UID but seemed to succeed"); } if (gidErrno > 0) { Err_raise(alloc, "Failed to set GID [%s]", strerror(gidErrno)); } if (gid != (int) getgid()) { Err_raise(alloc, "Failed to set GID but seemed to succeed"); } return NULL; } static int canOpenFiles() { int file = dup(0); close(file); return file >= 0; } Err_DEFUN Security_nofiles(struct Allocator* errAlloc) { #if !defined(RLIMIT_NOFILE) && defined(RLIMIT_OFILE) #define RLIMIT_NOFILE RLIMIT_OFILE #endif if (!canOpenFiles()) { Err_raise(errAlloc, "Unable to dupe stdin"); } if (setrlimit(RLIMIT_NOFILE, &(struct rlimit){ 0, 0 })) { Err_raise(errAlloc, "Failed to set open file limit to 0 [%s]", strerror(errno)); } if (canOpenFiles()) { Err_raise(errAlloc, "Still able to dupe stdin after setting number of files to 0!"); } return NULL; } Err_DEFUN Security_noforks(struct Allocator* errAlloc) { if (setrlimit(RLIMIT_NPROC, &(struct rlimit){ 0, 0 })) { Err_raise(errAlloc, "Failed to set fork limit to 0 [%s]", strerror(errno)); } return NULL; } Err_DEFUN Security_chroot(char* root, struct Allocator* errAlloc) { if (chdir(root)) { Err_raise(errAlloc, "chdir(%s) -> [%s]", root, strerror(errno)); } if (chroot(root)) { Err_raise(errAlloc, "chroot(%s) -> [%s]", root, strerror(errno)); } return NULL; } struct Security_pvt { struct Security pub; struct Allocator* setupAlloc; struct Log* log; Identity }; void Security_setupComplete(struct Security* security) { struct Security_pvt* sec = Identity_check((struct Security_pvt*) security); sec->pub.setupComplete = 1; Allocator_free(sec->setupAlloc); } static void fail(void* vSec) { struct Security_pvt* sec = Identity_check((struct Security_pvt*) vSec); Log_critical(sec->log, "Security_setupComplete() not called in time, exiting"); exit(232); } struct Security* Security_new(struct Allocator* alloc, struct Log* log, EventBase_t* base) { struct Security_pvt* sec = Allocator_calloc(alloc, sizeof(struct Security_pvt), 1); Identity_set(sec); sec->setupAlloc = Allocator_child(alloc); Timeout_setInterval(fail, sec, 20000, base, sec->setupAlloc); sec->log = log; return &sec->pub; } Err_DEFUN Security_checkPermissions(struct Security_Permissions** outP, struct Allocator* alloc) { struct Security_Permissions* out = Allocator_calloc(alloc, sizeof(struct Security_Permissions), 1); out->noOpenFiles = !canOpenFiles(); out->uid = getuid(); *outP = out; return NULL; }